-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory CVE-2025-1713 / XSA-467
deadlock potential with VT-d and legacy PCI device pass-through
ISSUE DESCRIPTION
=================
When setting up interrupt remapping for legacy PCI(-X) devices,
including PCI(-X) bridges, a lookup of the upstream bridge is required.
This lookup, itself involving acquiring of a lock, is done in a context
where acquiring that lock is unsafe. This can lead to a deadlock.
IMPACT
======
The passing through of certain kinds of devices to an unprivileged guest
can result in a Denial of Service (DoS) affecting the entire host.
Note: Normal usage of such devices by a privileged domain can also
trigger the issue. In such a scenario, the deadlock is not
considered a security issue, but just a plain bug.
VULNERABLE SYSTEMS
==================
Xen versions 4.0 and later are affected. Xen versions 3.4 and earlier
are not directly affected, but had other issues.
Systems with Intel IOMMU hardware (VT-d) are affected. Systems using
AMD or non-x86 hardware are not affected.
Only systems where certain kinds of devices are passed through to an
unprivileged guest are vulnerable.
MITIGATION
==========
Avoiding the passing through of the affected device types will avoid
the vulnerability.
RESOLUTION
==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa467.patch xen-unstable - Xen 4.17.x
$ sha256sum xsa467*
2fffaa8892b3daecd698b4af95701045874a76edc2e18c8d2abbec85a39aa05c xsa467.patch
$
NOTE REGARDING LACK OF EMBARGO
==============================
The issue was reported initially on a public bug tracker and discussed in
public before it was realized that there was a security aspect.
-----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmfAX/kMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZ++UH/0n3V1omvWiPXQCSOl+HawK77MezS2MkjRx6HQ/N
0SeaaWodvhBMeGd/FAECc7CY3G+sdLkOmwpVFtKvxBOjMRyEc6IsqdAa1CxkUZ0p
S+K7/MNmBB8qzB73sSpFpssR7NYGQXTQNxbQOuYURSyyZK5yejavgQ0oTc8jhhsH
NQOaTJPU/p6HBjDRlPcWB9EraJlPsr2iqv4FrbzDK+dS+I8BpfmElpnJkQOiOECg
McfLgod2jwV8y9l9Zvzx8IXJMkWxIHTdXkgmZq2sDr6foiFEbFUHV1ZG0rr8l+Sl
ckqx01g9UEDVmvjasWVjxeZUiaMLtppAp3SrewGjGwlx6oA=
=3+H1
-----END PGP SIGNATURE-----
From: Jan Beulich <jbeulich@suse.com>
Subject: IOMMU/x86: the bus-to-bridge lock needs to be acquired IRQ-safe
The function's use from set_msi_source_id() is guaranteed to be in an
IRQs-off region. While the invocation of that function could be moved
ahead in msi_msg_to_remap_entry() (doesn't need to be in the IOMMU-
intremap-locked region), the call tree from map_domain_pirq() holds an
IRQ descriptor lock. Hence all use sites of the lock need become IRQ-
safe ones.
In find_upstream_bridge() do a tiny bit of tidying in adjacent code:
Change a variable's type to unsigned and merge a redundant assignment
into another variable's initializer.
This is XSA-467 / CVE-2025-1713.
Fixes: 476bbccc811c ("VT-d: fix MSI source-id of interrupt remapping")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
--- a/xen/drivers/passthrough/pci.c
+++ b/xen/drivers/passthrough/pci.c
@@ -354,20 +354,21 @@ static struct pci_dev *alloc_pdev(struct
switch ( pdev->type = pdev_type(pseg->nr, bus, devfn) )
{
unsigned int cap, sec_bus, sub_bus;
+ unsigned long flags;
case DEV_TYPE_PCIe2PCI_BRIDGE:
case DEV_TYPE_LEGACY_PCI_BRIDGE:
sec_bus = pci_conf_read8(pdev->sbdf, PCI_SECONDARY_BUS);
sub_bus = pci_conf_read8(pdev->sbdf, PCI_SUBORDINATE_BUS);
- spin_lock(&pseg->bus2bridge_lock);
+ spin_lock_irqsave(&pseg->bus2bridge_lock, flags);
for ( ; sec_bus <= sub_bus; sec_bus++ )
{
pseg->bus2bridge[sec_bus].map = 1;
pseg->bus2bridge[sec_bus].bus = bus;
pseg->bus2bridge[sec_bus].devfn = devfn;
}
- spin_unlock(&pseg->bus2bridge_lock);
+ spin_unlock_irqrestore(&pseg->bus2bridge_lock, flags);
break;
case DEV_TYPE_PCIe_ENDPOINT:
@@ -437,16 +438,17 @@ static void free_pdev(struct pci_seg *ps
switch ( pdev->type )
{
unsigned int sec_bus, sub_bus;
+ unsigned long flags;
case DEV_TYPE_PCIe2PCI_BRIDGE:
case DEV_TYPE_LEGACY_PCI_BRIDGE:
sec_bus = pci_conf_read8(pdev->sbdf, PCI_SECONDARY_BUS);
sub_bus = pci_conf_read8(pdev->sbdf, PCI_SUBORDINATE_BUS);
- spin_lock(&pseg->bus2bridge_lock);
+ spin_lock_irqsave(&pseg->bus2bridge_lock, flags);
for ( ; sec_bus <= sub_bus; sec_bus++ )
pseg->bus2bridge[sec_bus] = pseg->bus2bridge[pdev->bus];
- spin_unlock(&pseg->bus2bridge_lock);
+ spin_unlock_irqrestore(&pseg->bus2bridge_lock, flags);
break;
default:
@@ -1053,8 +1055,9 @@ enum pdev_type pdev_type(u16 seg, u8 bus
int find_upstream_bridge(u16 seg, u8 *bus, u8 *devfn, u8 *secbus)
{
struct pci_seg *pseg = get_pseg(seg);
- int ret = 0;
- int cnt = 0;
+ int ret = 1;
+ unsigned long flags;
+ unsigned int cnt = 0;
if ( *bus == 0 )
return 0;
@@ -1065,8 +1068,7 @@ int find_upstream_bridge(u16 seg, u8 *bu
if ( !pseg->bus2bridge[*bus].map )
return 0;
- ret = 1;
- spin_lock(&pseg->bus2bridge_lock);
+ spin_lock_irqsave(&pseg->bus2bridge_lock, flags);
while ( pseg->bus2bridge[*bus].map )
{
*secbus = *bus;
@@ -1080,7 +1082,7 @@ int find_upstream_bridge(u16 seg, u8 *bu
}
out:
- spin_unlock(&pseg->bus2bridge_lock);
+ spin_unlock_irqrestore(&pseg->bus2bridge_lock, flags);
return ret;
}
Hello, Le 27/02/2025 à 13:57, Xen.org security team a écrit : > Xen Security Advisory CVE-2025-1713 / XSA-467 > > deadlock potential with VT-d and legacy PCI device pass-through > > ISSUE DESCRIPTION > ================= > > When setting up interrupt remapping for legacy PCI(-X) devices, > including PCI(-X) bridges, a lookup of the upstream bridge is required. > This lookup, itself involving acquiring of a lock, is done in a context > where acquiring that lock is unsafe. This can lead to a deadlock. > > IMPACT > ====== > > The passing through of certain kinds of devices to an unprivileged guest > can result in a Denial of Service (DoS) affecting the entire host. > > Note: Normal usage of such devices by a privileged domain can also > trigger the issue. In such a scenario, the deadlock is not > considered a security issue, but just a plain bug. > > VULNERABLE SYSTEMS > ================== > > Xen versions 4.0 and later are affected. Xen versions 3.4 and earlier > are not directly affected, but had other issues. > > Systems with Intel IOMMU hardware (VT-d) are affected. Systems using > AMD or non-x86 hardware are not affected. > > Only systems where certain kinds of devices are passed through to an > unprivileged guest are vulnerable. > > MITIGATION > ========== > > Avoiding the passing through of the affected device types will avoid > the vulnerability. > Is disabling interrupt remapping another way of mitigating this vulnerability (e.g iommu=no-intremap) ? > RESOLUTION > ========== > > Applying the attached patch resolves this issue. > > Note that patches for released versions are generally prepared to > apply to the stable branches, and may not apply cleanly to the most > recent release tarball. Downstreams are encouraged to update to the > tip of the stable branch before applying these patches. > > xsa467.patch xen-unstable - Xen 4.17.x > > $ sha256sum xsa467* > 2fffaa8892b3daecd698b4af95701045874a76edc2e18c8d2abbec85a39aa05c xsa467.patch > $ > > NOTE REGARDING LACK OF EMBARGO > ============================== > > The issue was reported initially on a public bug tracker and discussed in > public before it was realized that there was a security aspect. Teddy Teddy Astie | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech
On Thu, Feb 27, 2025 at 03:33:18PM +0000, Teddy Astie wrote: > Hello, > > Le 27/02/2025 à 13:57, Xen.org security team a écrit : > > Xen Security Advisory CVE-2025-1713 / XSA-467 > > > > deadlock potential with VT-d and legacy PCI device pass-through > > > > ISSUE DESCRIPTION > > ================= > > > > When setting up interrupt remapping for legacy PCI(-X) devices, > > including PCI(-X) bridges, a lookup of the upstream bridge is required. > > This lookup, itself involving acquiring of a lock, is done in a context > > where acquiring that lock is unsafe. This can lead to a deadlock. > > > > IMPACT > > ====== > > > > The passing through of certain kinds of devices to an unprivileged guest > > can result in a Denial of Service (DoS) affecting the entire host. > > > > Note: Normal usage of such devices by a privileged domain can also > > trigger the issue. In such a scenario, the deadlock is not > > considered a security issue, but just a plain bug. > > > > VULNERABLE SYSTEMS > > ================== > > > > Xen versions 4.0 and later are affected. Xen versions 3.4 and earlier > > are not directly affected, but had other issues. > > > > Systems with Intel IOMMU hardware (VT-d) are affected. Systems using > > AMD or non-x86 hardware are not affected. > > > > Only systems where certain kinds of devices are passed through to an > > unprivileged guest are vulnerable. > > > > MITIGATION > > ========== > > > > Avoiding the passing through of the affected device types will avoid > > the vulnerability. > > > > Is disabling interrupt remapping another way of mitigating this > vulnerability (e.g iommu=no-intremap) ? No, as this allows other attacks that allow denial of service at the very least. See https://lore.kernel.org/xen-devel/19915.58644.191837.671729@mariner.uk.xensource.com/. -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab
© 2016 - 2025 Red Hat, Inc.